From 8d0794576c75dd95dca989c09d18ac31b6c6eb97 Mon Sep 17 00:00:00 2001
From: mattf <mattf@3d104415-ff17-0410-8863-d5cf3c621b8a>
Date: Tue, 1 Mar 2022 03:32:17 +0000
Subject: [PATCH] Added allow_web_debug system setting and variable filtering

git-svn-id: svn://192.168.202.10@3575 3d104415-ff17-0410-8863-d5cf3c621b8a
---
 www/vicidial/asterisk_debug.php               |  29 ++--
 www/vicidial/callbacks_export.php             |  83 +++++-------
 www/vicidial/callcard_report_export.php       |  53 +++++---
 .../called_counts_multilist_report.php        |  79 ++++++-----
 www/vicidial/callerID_log_report.php          | 127 ++++++++++--------
 www/vicidial/campaign_debug.php               |  29 ++--
 www/vicidial/fcstats.php                      |  60 +++++----
 www/vicidial/fcstats_detail.php               | 112 +++++++++------
 www/vicidial/lead_report_export.php           | 100 +++++++++-----
 www/vicidial/medialog_inventory_report.php    |  56 +++++---
 10 files changed, 427 insertions(+), 301 deletions(-)

diff --git a/www/vicidial/asterisk_debug.php b/www/vicidial/asterisk_debug.php
index ddfa0296..843c30e3 100644
--- a/www/vicidial/asterisk_debug.php
+++ b/www/vicidial/asterisk_debug.php
@@ -1,12 +1,13 @@
 <?php 
 # asterisk_debug.php
 # 
-# Copyright (C) 2019  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # CHANGES
 # 151229-1703 - First build
 # 170409-1536 - Added IP List validation code
 # 191013-0905 - Fixes for PHP7
+# 220228-2155 - Added allow_web_debug system setting
 #
 
 $startMS = microtime();
@@ -31,11 +32,16 @@ if (isset($_GET["SUBMIT"]))				{$SUBMIT=$_GET["SUBMIT"];}
 
 $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
+$NOW_DATE = date("Y-m-d");
+$NOW_TIME = date("Y-m-d H:i:s");
+$STARTtime = date("U");
+if (!isset($query_date)) {$query_date = $NOW_DATE;}
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method FROM system_settings;";
+$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -46,10 +52,16 @@ if ($qm_conf_ct > 0)
 	$user_territories_active =		$row[3];
 	$SSenable_languages =			$row[4];
 	$SSlanguage_method =			$row[5];
+	$SSallow_web_debug =			$row[6];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
 
+$group = preg_replace('/[^-\.\:\_0-9a-zA-Z]/', '', $group);
+$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT);
+
 if ($non_latin < 1)
 	{
 	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
@@ -57,8 +69,8 @@ if ($non_latin < 1)
 	}
 else
 	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
 	}
 
 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
@@ -205,13 +217,6 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_
 	$MAIN.="<!-- Using slave server $slave_db_server $db_source -->\n";
 	}
 
-$NOW_DATE = date("Y-m-d");
-$NOW_TIME = date("Y-m-d H:i:s");
-$STARTtime = date("U");
-if (!isset($group)) {$group = array();}
-if (!isset($query_date)) {$query_date = $NOW_DATE;}
-if (!isset($server_ip)) {$server_ip = '10.10.10.15';}
-
 $stmt="SELECT server_id,server_ip from servers order by server_id;";
 $rslt=mysql_to_mysqli($stmt, $link);
 if ($DB) {echo "$stmt\n";}
diff --git a/www/vicidial/callbacks_export.php b/www/vicidial/callbacks_export.php
index 4fdd0b23..d418a1b4 100644
--- a/www/vicidial/callbacks_export.php
+++ b/www/vicidial/callbacks_export.php
@@ -1,10 +1,11 @@
 <?php
 # callbacks_export.php
 # 
-# Copyright (C) 2020  Matt Florell <vicidial@gmail.com>, Joe Johnson <joej@vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>, Joe Johnson <joej@vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # CHANGES
 # 200622-1615 - First build 
+# 220228-2126 - Added allow_web_debug system setting
 #
 
 require("dbconnect_mysqli.php");
@@ -14,53 +15,40 @@ $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
 $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
 $PHP_SELF=$_SERVER['PHP_SELF'];
 $PHP_SELF = preg_replace('/\.php.*/i','.php',$PHP_SELF);
-if (isset($_GET["days"]))				{$days=$_GET["days"];}
-	elseif (isset($_POST["days"]))		{$days=$_POST["days"];}
-if (isset($_GET["user"]))				{$user=$_GET["user"];}
-	elseif (isset($_POST["user"]))		{$user=$_POST["user"];}
-if (isset($_GET["list_id"]))			{$list_id=$_GET["list_id"];}
-	elseif (isset($_POST["list_id"]))	{$list_id=$_POST["list_id"];}
-if (isset($_GET["campaign_id"]))			{$campaign_id=$_GET["campaign_id"];}
-	elseif (isset($_POST["campaign_id"]))	{$campaign_id=$_POST["campaign_id"];}
-if (isset($_GET["user_group"]))				{$user_group=$_GET["user_group"];}
-	elseif (isset($_POST["user_group"]))	{$user_group=$_POST["user_group"];}
-if (isset($_GET["stage"]))				{$stage=$_GET["stage"];}
-	elseif (isset($_POST["stage"]))		{$stage=$_POST["stage"];}
-if (isset($_GET["confirm_transfer"]))			{$confirm_transfer=$_GET["confirm_transfer"];}
-	elseif (isset($_POST["confirm_transfer"]))	{$confirm_transfer=$_POST["confirm_transfer"];}
 if (isset($_GET["DB"]))					{$DB=$_GET["DB"];}
 	elseif (isset($_POST["DB"]))		{$DB=$_POST["DB"];}
 if (isset($_GET["submit"]))				{$submit=$_GET["submit"];}
 	elseif (isset($_POST["submit"]))	{$submit=$_POST["submit"];}
 if (isset($_GET["SUBMIT"]))				{$SUBMIT=$_GET["SUBMIT"];}
 	elseif (isset($_POST["SUBMIT"]))	{$SUBMIT=$_POST["SUBMIT"];}
-if (isset($_GET["file_download"]))					{$file_download=$_GET["file_download"];}
+if (isset($_GET["file_download"]))				{$file_download=$_GET["file_download"];}
 	elseif (isset($_POST["file_download"]))		{$file_download=$_POST["file_download"];}
-
-if (isset($_GET["query_date"]))			{$query_date=$_GET["query_date"];}
+if (isset($_GET["query_date"]))				{$query_date=$_GET["query_date"];}
 	elseif (isset($_POST["query_date"]))	{$query_date=$_POST["query_date"];}
 if (isset($_GET["end_date"]))			{$end_date=$_GET["end_date"];}
 	elseif (isset($_POST["end_date"]))	{$end_date=$_POST["end_date"];}
 if (isset($_GET["cb_groups"]))			{$cb_groups=$_GET["cb_groups"];}
 	elseif (isset($_POST["cb_groups"]))	{$cb_groups=$_POST["cb_groups"];}
-if (isset($_GET["cb_user_groups"]))			{$cb_user_groups=$_GET["cb_user_groups"];}
-	elseif (isset($_POST["cb_user_groups"]))	{$cb_user_groups=$_POST["cb_user_groups"];}
-if (isset($_GET["cb_lists"]))			{$cb_lists=$_GET["cb_lists"];}
-	elseif (isset($_POST["cb_lists"]))	{$cb_lists=$_POST["cb_lists"];}
-if (isset($_GET["cb_users"]))			{$cb_users=$_GET["cb_users"];}
-	elseif (isset($_POST["cb_users"]))	{$cb_users=$_POST["cb_users"];}
-if (isset($_GET["callback_time_start"]))			{$callback_time_start=$_GET["callback_time_start"];}
-	elseif (isset($_POST["callback_time_start"]))	{$callback_time_start=$_POST["callback_time_start"];}
-if (isset($_GET["callback_time_end"]))			{$callback_time_end=$_GET["callback_time_end"];}
-	elseif (isset($_POST["callback_time_end"]))	{$callback_time_end=$_POST["callback_time_end"];}
 
 $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
+$StarTtimE = date("U");
+$TODAY = date("Y-m-d");
+$NOW_TIME = date("Y-m-d H:i:s");
+if (!isset($cb_groups)) {$cb_groups=array();}
+if (!isset($query_date)) {$query_date = $TODAY;}
+if (!isset($end_date)) {$end_date = $TODAY;}
+$ip = getenv("REMOTE_ADDR");
+$date = date("r");
+$ip = getenv("REMOTE_ADDR");
+$browser = getenv("HTTP_USER_AGENT");
+$report_name="CALLBACKS EXPORT";
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,enable_languages,language_method,qc_features_active FROM system_settings;";
+$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,enable_languages,language_method,qc_features_active,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -71,10 +59,23 @@ if ($qm_conf_ct > 0)
 	$SSenable_languages =			$row[3];
 	$SSlanguage_method =			$row[4];
 	$SSqc_features_active =			$row[5];
+	$SSallow_web_debug =			$row[6];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
 
+$query_date = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $query_date);
+$end_date = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $end_date);
+$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT);
+$search_archived_data = preg_replace('/[^-_0-9a-zA-Z]/', '', $search_archived_data);
+$file_download = preg_replace('/[^-_0-9a-zA-Z]/', '', $file_download);
+$report_display_type = preg_replace('/[^-_0-9a-zA-Z]/', '', $report_display_type);
+
+# Variables filtered further down in the code
+# $cb_groups
+
 if ($non_latin < 1)
 	{
 	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
@@ -82,23 +83,10 @@ if ($non_latin < 1)
 	}
 else
 	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
 	}
 
-$StarTtimE = date("U");
-$TODAY = date("Y-m-d");
-$NOW_TIME = date("Y-m-d H:i:s");
-if (!isset($group)) {$group=array();}
-if (!isset($users)) {$users=array();}
-if (!isset($query_date)) {$query_date = $TODAY;}
-if (!isset($end_date)) {$end_date = $TODAY;}
-$ip = getenv("REMOTE_ADDR");
-$date = date("r");
-$ip = getenv("REMOTE_ADDR");
-$browser = getenv("HTTP_USER_AGENT");
-$report_name="CALLBACKS EXPORT";
-
 $stmt="SELECT selected_language,qc_enabled from vicidial_users where user='$PHP_AUTH_USER';";
 if ($DB) {echo "|$stmt|\n";}
 $rslt=mysql_to_mysqli($stmt, $link);
@@ -214,7 +202,6 @@ $NWE = "')\" WIDTH=20 HEIGHT=20 BORDER=0 ALT=\"HELP\" ALIGN=TOP>";
 
 if ($SUBMIT) 
 	{
-
 	##### BEGIN log visit to the vicidial_report_log table #####
 	$LOGip = getenv("REMOTE_ADDR");
 	$LOGbrowser = getenv("HTTP_USER_AGENT");
@@ -298,6 +285,10 @@ if ($SUBMIT)
 
 	if (count($cb_groups)>0 && $query_date)
 		{
+		for ($i=0; $i<count($cb_groups); $i++) 
+			{
+			$cb_groups[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $cb_groups[$i]);
+			}
 
 		if (in_array("ALL", $cb_groups)) 
 			{
diff --git a/www/vicidial/callcard_report_export.php b/www/vicidial/callcard_report_export.php
index 98e0b261..0a1b0fc7 100644
--- a/www/vicidial/callcard_report_export.php
+++ b/www/vicidial/callcard_report_export.php
@@ -5,7 +5,7 @@
 # batch, pack and date range. 
 # downloads to a flat text file that is tab delimited
 #
-# Copyright (C) 2017  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # CHANGES
 #
@@ -17,6 +17,7 @@
 # 141230-1348 - Added code for on-the-fly language translations display
 # 170409-1534 - Added IP List validation code
 # 170829-0040 - Added screen color settings
+# 220228-2119 - Added allow_web_debug system setting
 #
 
 require("dbconnect_mysqli.php");
@@ -51,14 +52,24 @@ if (isset($_GET["submit"]))					{$submit=$_GET["submit"];}
 if (isset($_GET["SUBMIT"]))					{$SUBMIT=$_GET["SUBMIT"];}
 	elseif (isset($_POST["SUBMIT"]))		{$SUBMIT=$_POST["SUBMIT"];}
 
-if (strlen($shift)<2) {$shift='ALL';}
 $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
+$US='_';
+$MT[0]='';
+$ip = getenv("REMOTE_ADDR");
+$NOW_DATE = date("Y-m-d");
+$NOW_TIME = date("Y-m-d H:i:s");
+$FILE_TIME = date("Ymd-His");
+$STARTtime = date("U");
+if (!isset($query_date)) {$query_date = $NOW_DATE;}
+if (!isset($end_date)) {$end_date = $NOW_DATE;}
+if (strlen($shift)<2) {$shift='ALL';}
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,enable_languages,language_method FROM system_settings;";
+$stmt = "SELECT use_non_latin,enable_languages,language_method,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -66,10 +77,24 @@ if ($qm_conf_ct > 0)
 	$non_latin = 				$row[0];
 	$SSenable_languages =		$row[1];
 	$SSlanguage_method =		$row[2];
+	$SSallow_web_debug =		$row[3];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
 
+$query_date = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $query_date);
+$end_date = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $end_date);
+$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT);
+$run = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$run);
+$batch = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$batch);
+$pack = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$pack);
+$agent = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$agent);
+$did = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$did);
+$callerid = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$callerid);
+$run_export = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$run_export);
+
 if ($non_latin < 1)
 	{
 	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
@@ -77,8 +102,8 @@ if ($non_latin < 1)
 	}
 else
 	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
 	}
 
 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
@@ -165,16 +190,6 @@ if ($LOGcallcard_admin < 1)
 ##### START RUN THE EXPORT AND OUTPUT FLAT DATA FILE #####
 if ($run_export > 0)
 	{
-	$US='_';
-	$MT[0]='';
-	$ip = getenv("REMOTE_ADDR");
-	$NOW_DATE = date("Y-m-d");
-	$NOW_TIME = date("Y-m-d H:i:s");
-	$FILE_TIME = date("Ymd-His");
-	$STARTtime = date("U");
-	if (!isset($query_date)) {$query_date = $NOW_DATE;}
-	if (!isset($end_date)) {$end_date = $NOW_DATE;}
-
 	$inbound_to_print=0;
 	$export_rows='';
 	$k=0;
@@ -267,12 +282,6 @@ if ($run_export > 0)
 
 else
 	{
-	$NOW_DATE = date("Y-m-d");
-	$NOW_TIME = date("Y-m-d H:i:s");
-	$STARTtime = date("U");
-	if (!isset($query_date)) {$query_date = $NOW_DATE;}
-	if (!isset($end_date)) {$end_date = $NOW_DATE;}
-
 	echo "<HTML><HEAD>\n";
 
 	echo "<script language=\"JavaScript\" src=\"calendar_db.js\"></script>\n";
diff --git a/www/vicidial/called_counts_multilist_report.php b/www/vicidial/called_counts_multilist_report.php
index e8ab9fe1..1e513f80 100644
--- a/www/vicidial/called_counts_multilist_report.php
+++ b/www/vicidial/called_counts_multilist_report.php
@@ -1,7 +1,7 @@
 <?php
 # called_counts_multilist_report.php
 # 
-# Copyright (C) 2019  Joe Johnson <freewermadmin@gmail.com>, Matt Florell <mattf@vicidial.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Joe Johnson <freewermadmin@gmail.com>, Matt Florell <mattf@vicidial.com>    LICENSE: AGPLv2
 #
 # This is a report designed for showing called counts similar to the results
 # at the bottom of each list detail screen, but for multiple lists and using
@@ -19,6 +19,7 @@
 # 170829-0040 - Added screen color settings
 # 180508-0115 - Added new help display
 # 191013-0840 - Fixes for PHP7
+# 220228-2108 - Added allow_web_debug system setting
 #
 
 $startMS = microtime();
@@ -35,9 +36,9 @@ $PHP_SELF=$_SERVER['PHP_SELF'];
 $PHP_SELF = preg_replace('/\.php.*/i','.php',$PHP_SELF);
 if (isset($_GET["list_ids"]))				{$list_ids=$_GET["list_ids"];}
 	elseif (isset($_POST["list_ids"]))		{$list_ids=$_POST["list_ids"];}
-if (isset($_GET["override_date"]))				{$override_date=$_GET["override_date"];}
+if (isset($_GET["override_date"]))			{$override_date=$_GET["override_date"];}
 	elseif (isset($_POST["override_date"]))	{$override_date=$_POST["override_date"];}
-if (isset($_GET["group"]))				{$group=$_GET["group"];}
+if (isset($_GET["group"]))			{$group=$_GET["group"];}
 	elseif (isset($_POST["group"]))	{$group=$_POST["group"];}
 if (isset($_GET["query_date"]))				{$query_date=$_GET["query_date"];}
 	elseif (isset($_POST["query_date"]))	{$query_date=$_POST["query_date"];}
@@ -49,21 +50,27 @@ if (isset($_GET["DB"]))					{$DB=$_GET["DB"];}
 	elseif (isset($_POST["DB"]))		{$DB=$_POST["DB"];}
 if (isset($_GET["submit"]))				{$submit=$_GET["submit"];}
 	elseif (isset($_POST["submit"]))	{$submit=$_POST["submit"];}
-if (isset($_GET["file_download"]))				{$file_download=$_GET["file_download"];}
+if (isset($_GET["file_download"]))			{$file_download=$_GET["file_download"];}
 	elseif (isset($_POST["file_download"]))	{$file_download=$_POST["file_download"];}
 if (isset($_GET["SUBMIT"]))				{$SUBMIT=$_GET["SUBMIT"];}
 	elseif (isset($_POST["SUBMIT"]))	{$SUBMIT=$_POST["SUBMIT"];}
-if (isset($_GET["report_display_type"]))				{$report_display_type=$_GET["report_display_type"];}
+if (isset($_GET["report_display_type"]))			{$report_display_type=$_GET["report_display_type"];}
 	elseif (isset($_POST["report_display_type"]))	{$report_display_type=$_POST["report_display_type"];}
 if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search_archived_data"];}
 	elseif (isset($_POST["search_archived_data"]))	{$search_archived_data=$_POST["search_archived_data"];}
 
-if (strlen($shift)<2) {$shift='ALL';}
-if (strlen($bottom_graph)<2) {$bottom_graph='NO';}
-if (strlen($carrier_stats)<2) {$carrier_stats='NO';}
-if (strlen($include_rollover)<2) {$include_rollover='NO';}
 $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
+$NOW_DATE = date("Y-m-d");
+$NOW_TIME = date("Y-m-d H:i:s");
+$STARTtime = date("U");
+if (!isset($group)) {$group = array();}
+if (!isset($list_ids)) {$list_ids = array();}
+if (!isset($query_date)) {$query_date = $NOW_DATE;}
+if (!isset($end_date)) {$end_date = $NOW_DATE;}
+if (strlen($shift)<2) {$shift='ALL';}
+if (strlen($include_rollover)<2) {$include_rollover='NO';}
+
 $report_name = 'Called Counts List IDs Report';
 $db_source = 'M';
 $JS_text="<script language='Javascript'>\n";
@@ -74,9 +81,9 @@ $JS_text.="  }\n";
 $JS_onload="onload = function() {\n";
 
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method FROM system_settings;";
+$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -87,10 +94,37 @@ if ($qm_conf_ct > 0)
 	$reports_use_slave_db =			$row[3];
 	$SSenable_languages =			$row[4];
 	$SSlanguage_method =			$row[5];
+	$SSallow_web_debug =			$row[6];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
 
+$query_date = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $query_date);
+$end_date = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $end_date);
+$override_date = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $override_date);
+$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT);
+$search_archived_data = preg_replace('/[^-_0-9a-zA-Z]/', '', $search_archived_data);
+$shift = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$shift);
+$file_download = preg_replace('/[^-_0-9a-zA-Z]/', '', $file_download);
+$report_display_type = preg_replace('/[^-_0-9a-zA-Z]/', '', $report_display_type);
+
+# Variables filtered further down in the code
+# $list_ids
+# $group
+
+if ($non_latin < 1)
+	{
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
+	}
+else
+	{
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
+	}
+
 ### ARCHIVED DATA CHECK CONFIGURATION
 $archives_available="N";
 $log_tables_array=array("vicidial_list", "vicidial_log", "vicidial_closer_log", "user_call_log");
@@ -128,17 +162,6 @@ if ($srv_conf_ct > 0)
 	$carrier_logging_active =		$row[0];
 	}
 
-if ($non_latin < 1)
-	{
-	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
-	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
-	}
-else
-	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
-	}
-
 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
 if ($DB) {echo "|$stmt|\n";}
 $rslt=mysql_to_mysqli($stmt, $link);
@@ -246,7 +269,7 @@ else
 	$webserver_id = mysqli_insert_id($link);
 	}
 
-$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$group[0], $query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';";
+$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';";
 if ($DB) {echo "|$stmt|\n";}
 $rslt=mysql_to_mysqli($stmt, $link);
 $report_log_id = mysqli_insert_id($link);
@@ -282,14 +305,6 @@ if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL
     exit;
 	}
 
-$NOW_DATE = date("Y-m-d");
-$NOW_TIME = date("Y-m-d H:i:s");
-$STARTtime = date("U");
-if (!isset($group)) {$group = array();}
-if (!isset($list_ids)) {$list_ids = array();}
-if (!isset($query_date)) {$query_date = $NOW_DATE;}
-if (!isset($end_date)) {$end_date = $NOW_DATE;}
-
 $i=0;
 $group_string='|';
 $group_ct = count($group);
@@ -367,6 +382,7 @@ $group_string='|';
 $group_ct = count($group);
 while($i < $group_ct)
 	{
+	$group[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $group[$i]);
 	if ( (preg_match("/ $group[$i] /",$regexLOGallowed_campaigns)) or (preg_match("/-ALL/",$LOGallowed_campaigns)) )
 		{
 		$group_string .= "$group[$i]|";
@@ -415,6 +431,7 @@ $list_id_string='|';
 $list_id_ct = count($list_ids);
 while($i < $list_id_ct)
 	{
+	$list_ids[$i] = preg_replace('/[^-_0-9a-zA-Z]/', '', $list_ids[$i]);
 	$list_id_string .= "$list_ids[$i]|";
 	$list_id_SQL .= "'$list_ids[$i]',";
 	$list_idQS .= "&list_ids[]=$list_ids[$i]";
diff --git a/www/vicidial/callerID_log_report.php b/www/vicidial/callerID_log_report.php
index 38b81f2e..4401fa9b 100644
--- a/www/vicidial/callerID_log_report.php
+++ b/www/vicidial/callerID_log_report.php
@@ -5,13 +5,14 @@
 # Created to find problematic caller IDs, which can be found if bad outbound calls are dispositioned 
 # particular statuses
 #
-# Copyright (C) 2020  Matt Florell <vicidial@gmail.com>, Joe Johnson <joej@vicidial.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>, Joe Johnson <joej@vicidial.com>    LICENSE: AGPLv2
 #
 # CHANGES
 #
 # 200115-1512 - First build
 # 200120-1430 - Added total calls, percentage of calls matched, default CID notation
 # 201111-1630 - Translation issue fix, Issue #1231
+# 220228-2053 - Added allow_web_debug system setting
 #
 
 $startMS = microtime();
@@ -35,7 +36,7 @@ if (isset($_GET["campaign"]))				{$campaign=$_GET["campaign"];}
 	elseif (isset($_POST["campaign"]))		{$campaign=$_POST["campaign"];}
 if (isset($_GET["status"]))					{$status=$_GET["status"];}
 	elseif (isset($_POST["status"]))		{$status=$_POST["status"];}
-if (isset($_GET["interval"]))						{$interval=$_GET["interval"];}
+if (isset($_GET["interval"]))					{$interval=$_GET["interval"];}
 	elseif (isset($_POST["interval"]))			{$interval=$_POST["interval"];}
 if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search_archived_data"];}
 	elseif (isset($_POST["search_archived_data"]))	{$search_archived_data=$_POST["search_archived_data"];}
@@ -46,16 +47,78 @@ if (isset($_GET["SUBMIT"]))					{$SUBMIT=$_GET["SUBMIT"];}
 if (isset($_GET["file_download"]))			{$file_download=$_GET["file_download"];}
 	elseif (isset($_POST["file_download"]))	{$file_download=$_POST["file_download"];}
 
-if (strlen($shift)<2) {$shift='ALL';}
 $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
+$US='_';
+$MT[0]='';
+$ip = getenv("REMOTE_ADDR");
+$NOW_DATE = date("Y-m-d");
+$NOW_TIME = date("Y-m-d H:i:s");
+$FILE_TIME = date("Ymd-His");
+$STARTtime = date("U");
+if (!isset($campaign)) {$campaign = array();}
+if (!isset($status)) {$status = array();}
+if (!isset($query_date)) {$query_date = $NOW_DATE;}
+if (!isset($end_date)) {$end_date = $NOW_DATE;}
+if (!isset($query_time)) {$query_time = "00:00:00";}
+if (!isset($end_time)) {$end_time = "23:59:59";}
+if (strlen($shift)<2) {$shift='ALL';}
+
 $report_name = 'Caller ID Log Report';
 $db_source = 'M';
 $file_exported=0;
 $NWB = "<IMG SRC=\"help.png\" onClick=\"FillAndShowHelpDiv(event, '";
 $NWE = "')\" WIDTH=20 HEIGHT=20 BORDER=0 ALT=\"HELP\" ALIGN=TOP>";
 if (!isset($interval)) {$interval = '0';}
+
+#############################################
+##### START SYSTEM_SETTINGS LOOKUP #####
+$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,custom_fields_enabled,enable_languages,language_method,active_modules,allow_web_debug FROM system_settings;";
+$rslt=mysql_to_mysqli($stmt, $link);
+#if ($DB) {echo "$stmt\n";}
+$qm_conf_ct = mysqli_num_rows($rslt);
+if ($qm_conf_ct > 0)
+	{
+	$row=mysqli_fetch_row($rslt);
+	$non_latin =					$row[0];
+	$outbound_autodial_active =		$row[1];
+	$slave_db_server =				$row[2];
+	$reports_use_slave_db =			$row[3];
+	$custom_fields_enabled =		$row[4];
+	$SSenable_languages =			$row[5];
+	$SSlanguage_method =			$row[6];
+	$active_modules =				$row[7];
+	$SSallow_web_debug =			$row[8];
+	}
+if ($SSallow_web_debug < 1) {$DB=0;}
+##### END SETTINGS LOOKUP #####
+###########################################
+
 $interval=preg_replace('/[^0-9]/', '', $interval);
+$query_date = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $query_date);
+$end_date = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $end_date);
+$query_time = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $query_time);
+$end_time = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $end_time);
+$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT);
+$search_archived_data = preg_replace('/[^-_0-9a-zA-Z]/', '', $search_archived_data);
+$file_download = preg_replace('/[^-_0-9a-zA-Z]/', '', $file_download);
+$report_display_type = preg_replace('/[^-_0-9a-zA-Z]/', '', $report_display_type);
+
+# Variables filtered further down in the code
+# $campaign
+# $status
+
+if ($non_latin < 1)
+	{
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
+	}
+else
+	{
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
+	}
 
 ### ARCHIVED DATA CHECK CONFIGURATION
 $archives_available="N";
@@ -78,39 +141,6 @@ else
 	$vicidial_log_table="vicidial_log";
 	}
 #############
-
-
-#############################################
-##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,custom_fields_enabled,enable_languages,language_method,active_modules FROM system_settings;";
-$rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
-$qm_conf_ct = mysqli_num_rows($rslt);
-if ($qm_conf_ct > 0)
-	{
-	$row=mysqli_fetch_row($rslt);
-	$non_latin =					$row[0];
-	$outbound_autodial_active =		$row[1];
-	$slave_db_server =				$row[2];
-	$reports_use_slave_db =			$row[3];
-	$custom_fields_enabled =		$row[4];
-	$SSenable_languages =			$row[5];
-	$SSlanguage_method =			$row[6];
-	$active_modules =				$row[7];
-	}
-##### END SETTINGS LOOKUP #####
-###########################################
-if ($non_latin < 1)
-	{
-	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
-	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
-	}
-else
-	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
-	}
-
 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
 if ($DB) {echo "|$stmt|\n";}
 $rslt=mysql_to_mysqli($stmt, $link);
@@ -234,7 +264,7 @@ else
 	$webserver_id = mysqli_insert_id($link);
 	}
 
-$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name Carrier', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$campaign[0], $query_date, $end_date|', url='$LOGfull_url', webserver='$webserver_id';";
+$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name Carrier', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date|', url='$LOGfull_url', webserver='$webserver_id';";
 if ($DB) {echo "|$stmt|\n";}
 $rslt=mysql_to_mysqli($stmt, $link);
 $report_log_id = mysqli_insert_id($link);
@@ -300,17 +330,6 @@ if ( (!preg_match('/\-\-ALL\-\-/i', $LOGadmin_viewable_call_times)) and (strlen(
 ##### START RUN THE EXPORT AND OUTPUT FLAT DATA FILE #####
 if ($SUBMIT)
 	{
-	$US='_';
-	$MT[0]='';
-	$ip = getenv("REMOTE_ADDR");
-	$NOW_DATE = date("Y-m-d");
-	$NOW_TIME = date("Y-m-d H:i:s");
-	$FILE_TIME = date("Ymd-His");
-	$STARTtime = date("U");
-	if (!isset($campaign)) {$campaign = array();}
-	if (!isset($status)) {$status = array();}
-	if (!isset($query_date)) {$query_date = $NOW_DATE;}
-	if (!isset($end_date)) {$end_date = $NOW_DATE;}
 	$log_calls=0;
 	$total_calls=0;
 
@@ -332,6 +351,7 @@ if ($SUBMIT)
 	$i=0;
 	while($i < $campaign_ct)
 		{
+		$campaign[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $campaign[$i]);
 		if ( (preg_match("/ $campaign[$i] /",$regexLOGallowed_campaigns)) or (preg_match("/-ALL/",$LOGallowed_campaigns)) )
 			{
 			$campaign_string .= "$campaign[$i]|";
@@ -362,6 +382,7 @@ if ($SUBMIT)
 	$i=0;
 	while($i < $status_ct)
 		{
+		$status[$i] = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$status[$i]);
 		$status_string .= "$status[$i]|";
 		$status_SQL .= "'$status[$i]',";
 		$statusQS .= "&status[]=$status[$i]";
@@ -531,16 +552,6 @@ if ($SUBMIT)
 
 if ($file_exported < 1)
 	{
-	$NOW_DATE = date("Y-m-d");
-	$NOW_TIME = date("Y-m-d H:i:s");
-	$STARTtime = date("U");
-	if (!isset($campaign)) {$campaign = array();}
-	if (!isset($status)) {$status = array();}
-	if (!isset($query_date)) {$query_date = $NOW_DATE;}
-	if (!isset($end_date)) {$end_date = $NOW_DATE;}
-	if (!isset($query_time)) {$query_time = "00:00:00";}
-	if (!isset($end_time)) {$end_time = "23:59:59";}
-
 	$stmt="select campaign_id from vicidial_campaigns $whereLOGallowed_campaignsSQL order by campaign_id;";
 	$rslt=mysql_to_mysqli($stmt, $link);
 	if ($DB) {echo "$stmt\n";}
diff --git a/www/vicidial/campaign_debug.php b/www/vicidial/campaign_debug.php
index 18dbb8f4..5f843615 100644
--- a/www/vicidial/campaign_debug.php
+++ b/www/vicidial/campaign_debug.php
@@ -1,7 +1,7 @@
 <?php 
 # campaign_debug.php
 # 
-# Copyright (C) 2020  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # CHANGES
 # 110514-1231 - First build
@@ -17,6 +17,7 @@
 # 190716-0909 - Added Call Quota process output
 # 201122-2249 - Added Hopper debug output
 # 201219-2119 - Added SHARED campaign output
+# 220228-2048 - Added allow_web_debug system setting
 #
 
 $startMS = microtime();
@@ -41,11 +42,15 @@ if (isset($_GET["SUBMIT"]))				{$SUBMIT=$_GET["SUBMIT"];}
 
 $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
+$NOW_DATE = date("Y-m-d");
+$NOW_TIME = date("Y-m-d H:i:s");
+$STARTtime = date("U");
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method,allow_shared_dial FROM system_settings;";
+$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method,allow_shared_dial,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -57,19 +62,26 @@ if ($qm_conf_ct > 0)
 	$SSenable_languages =			$row[4];
 	$SSlanguage_method =			$row[5];
 	$SSallow_shared_dial =			$row[6];
+	$SSallow_web_debug =			$row[7];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
 
+$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT);
+
 if ($non_latin < 1)
 	{
 	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
 	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
+	$group = preg_replace('/[^-_0-9a-zA-Z]/', '', $group);
 	}
 else
 	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
+	$group = preg_replace('/[^-_0-9\p{L}]/u', '', $group);
 	}
 
 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
@@ -208,13 +220,6 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_
 	$MAIN.="<!-- Using slave server $slave_db_server $db_source -->\n";
 	}
 
-$NOW_DATE = date("Y-m-d");
-$NOW_TIME = date("Y-m-d H:i:s");
-$STARTtime = date("U");
-if (!isset($group)) {$group = array();}
-if (!isset($query_date)) {$query_date = $NOW_DATE;}
-if (!isset($server_ip)) {$server_ip = '10.10.10.15';}
-
 $stmt="select campaign_id,campaign_name from vicidial_campaigns order by campaign_id;";
 $rslt=mysql_to_mysqli($stmt, $link);
 if ($DB) {echo "$stmt\n";}
diff --git a/www/vicidial/fcstats.php b/www/vicidial/fcstats.php
index 83942899..46cf1773 100644
--- a/www/vicidial/fcstats.php
+++ b/www/vicidial/fcstats.php
@@ -1,7 +1,7 @@
 <?php 
 # fcstats.php
 # 
-# Copyright (C) 2019  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # CHANGES
 #
@@ -41,6 +41,7 @@
 # 180508-2215 - Added new help display
 # 190216-0807 - Fix for user-group, in-group and campaign allowed/permissions matching issues
 # 191013-0821 - Fixes for PHP7
+# 220228-2044 - Added allow_web_debug system setting
 #
 
 $startMS = microtime();
@@ -71,9 +72,14 @@ if (isset($_GET["report_display_type"]))			{$report_display_type=$_GET["report_d
 if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search_archived_data"];}
 	elseif (isset($_POST["search_archived_data"]))	{$search_archived_data=$_POST["search_archived_data"];}
 
-if (strlen($shift)<2) {$shift='ALL';}
 $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
+$NOW_DATE = date("Y-m-d");
+$NOW_TIME = date("Y-m-d H:i:s");
+$STARTtime = date("U");
+if (!isset($group)) {$group = "CL_TEST_L";}
+if (!isset($query_date)) {$query_date = $NOW_DATE;}
+if (strlen($shift)<2) {$shift='ALL';}
 
 $report_name = 'Fronter - Closer Report';
 $db_source = 'M';
@@ -87,9 +93,9 @@ $JS_onload="onload = function() {\n";
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,report_default_format FROM system_settings;";
+$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,report_default_format,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {$HTML_text.="$stmt\n";}
+#if ($DB) {$HTML_text.="$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -101,11 +107,35 @@ if ($qm_conf_ct > 0)
 	$SSenable_languages =			$row[4];
 	$SSlanguage_method =			$row[5];
 	$SSreport_default_format =		$row[6];
+	$SSallow_web_debug =			$row[7];
 	}
-##### END SETTINGS LOOKUP #####
-###########################################
+if ($SSallow_web_debug < 1) {$DB=0;}
 if (strlen($report_display_type)<2) {$report_display_type = $SSreport_default_format;}
 if ($DB) {echo "report_display_type:|$report_display_type|$SSreport_default_format|\n";}
+##### END SETTINGS LOOKUP #####
+###########################################
+
+$query_date = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $query_date);
+$end_date = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $end_date);
+$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT);
+$search_archived_data = preg_replace('/[^-_0-9a-zA-Z]/', '', $search_archived_data);
+$shift = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$shift);
+$file_download = preg_replace('/[^-_0-9a-zA-Z]/', '', $file_download);
+$report_display_type = preg_replace('/[^-_0-9a-zA-Z]/', '', $report_display_type);
+
+if ($non_latin < 1)
+	{
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
+	$group = preg_replace('/[^-_0-9a-zA-Z]/', '', $group);
+	}
+else
+	{
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
+	$group = preg_replace('/[^-_0-9\p{L}]/u', '', $group);
+	}
 
 ### ARCHIVED DATA CHECK CONFIGURATION
 $archives_available="N";
@@ -129,18 +159,6 @@ else
 	}
 #############
 
-if ($non_latin < 1)
-	{
-	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
-	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
-	}
-else
-	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
-	}
-$shift = preg_replace("/'|\"|\\\\|;/","",$shift);
-
 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
 if ($DB) {echo "|$stmt|\n";}
 $rslt=mysql_to_mysqli($stmt, $link);
@@ -306,12 +324,6 @@ if ( (!preg_match('/\-\-ALL\-\-/i', $LOGadmin_viewable_call_times)) and (strlen(
 	$whereLOGadmin_viewable_call_timesSQL = "where call_time_id IN('---ALL---','$rawLOGadmin_viewable_call_timesSQL')";
 	}
 
-$NOW_DATE = date("Y-m-d");
-$NOW_TIME = date("Y-m-d H:i:s");
-$STARTtime = date("U");
-if (!isset($group)) {$group = "CL_TEST_L";}
-if (!isset($query_date)) {$query_date = $NOW_DATE;}
-
 $stmt="select group_id from vicidial_inbound_groups $whereLOGadmin_viewable_groupsSQL order by group_id;";
 $rslt=mysql_to_mysqli($stmt, $link);
 if ($DB) {$HTML_text.="$stmt\n";}
diff --git a/www/vicidial/fcstats_detail.php b/www/vicidial/fcstats_detail.php
index e7fa5fe7..a728e0b5 100644
--- a/www/vicidial/fcstats_detail.php
+++ b/www/vicidial/fcstats_detail.php
@@ -1,7 +1,7 @@
 <?php 
 # fcstats_detail.php
 # 
-# Copyright (C) 2019  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # CHANGES
 #
@@ -43,6 +43,7 @@
 # 180508-2215 - Added new help display
 # 190216-0808 - Fix for user-group, in-group and campaign allowed/permissions matching issues
 # 191013-0851 - Fixes for PHP7
+# 220228-1955 - Added allow_web_debug system setting
 #
 
 $startMS = microtime();
@@ -58,8 +59,8 @@ if (isset($_GET["DB"]))				{$DB=$_GET["DB"];}
 	elseif (isset($_POST["DB"]))	{$DB=$_POST["DB"];}
 if (isset($_GET["group"]))				{$group=$_GET["group"];}
 	elseif (isset($_POST["group"]))		{$group=$_POST["group"];}
-if (isset($_GET["campaign"]))					{$campaign=$_GET["campaign"];}
-	elseif (isset($_POST["campaign"]))			{$campaign=$_POST["campaign"];}
+if (isset($_GET["campaign"]))				{$campaign=$_GET["campaign"];}
+	elseif (isset($_POST["campaign"]))		{$campaign=$_POST["campaign"];}
 if (isset($_GET["users"]))					{$users=$_GET["users"];}
 	elseif (isset($_POST["users"]))			{$users=$_POST["users"];}
 if (isset($_GET["user_group"]))				{$user_group=$_GET["user_group"];}
@@ -83,18 +84,19 @@ if (isset($_GET["report_display_type"]))			{$report_display_type=$_GET["report_d
 if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search_archived_data"];}
 	elseif (isset($_POST["search_archived_data"]))	{$search_archived_data=$_POST["search_archived_data"];}
 
-if (strlen($shift)<2) {$shift='ALL';}
 $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $NOW_DATE = date("Y-m-d");
 $NOW_TIME = date("Y-m-d H:i:s");
 $STARTtime = date("U");
+$HTML_text='';
 if (!isset($user_group)) {$user_group = array();}
 if (!isset($campaign)) {$campaign = array();}
 if (!isset($users)) {$users = array();}
-if (!isset($group)) {$group = array("CL_TEST_L");}
+if (!isset($group)) {$group = array();}
 if (!isset($query_date)) {$query_date = $NOW_DATE;}
 if (!isset($end_date)) {$end_date = $query_date;}
+if (strlen($shift)<2) {$shift='ALL';}
 
 $report_name = 'Fronter - Closer Detail Report';
 $db_source = 'M';
@@ -108,9 +110,9 @@ $JS_onload="onload = function() {\n";
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,report_default_format FROM system_settings;";
+$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,report_default_format,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {$HTML_text.="$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -122,10 +124,39 @@ if ($qm_conf_ct > 0)
 	$SSenable_languages =			$row[4];
 	$SSlanguage_method =			$row[5];
 	$SSreport_default_format =		$row[6];
+	$SSallow_web_debug =			$row[7];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
+if (strlen($report_display_type)<2) {$report_display_type = $SSreport_default_format;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
-if (strlen($report_display_type)<2) {$report_display_type = $SSreport_default_format;}
+
+$query_date = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $query_date);
+$end_date = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $end_date);
+$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT);
+$search_archived_data = preg_replace('/[^-_0-9a-zA-Z]/', '', $search_archived_data);
+$shift = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$shift);
+$show_summary = preg_replace('/[^-_0-9a-zA-Z]/', '', $show_summary);
+$file_download = preg_replace('/[^-_0-9a-zA-Z]/', '', $file_download);
+$report_display_type = preg_replace('/[^-_0-9a-zA-Z]/', '', $report_display_type);
+
+# Variables filtered further down in the code
+# $user_group
+# $campaign
+# $users
+# $group
+
+if ($non_latin < 1)
+	{
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
+	}
+else
+	{
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
+	}
 
 ### ARCHIVED DATA CHECK CONFIGURATION
 $archives_available="N";
@@ -153,18 +184,6 @@ else
 	}
 #############
 
-if ($non_latin < 1)
-	{
-	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
-	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
-	}
-else
-	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
-	}
-$shift = preg_replace("/'|\"|\\\\|;/","",$shift);
-
 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
 if ($DB) {echo "|$stmt|\n";}
 $rslt=mysql_to_mysqli($stmt, $link);
@@ -272,7 +291,7 @@ else
 	$webserver_id = mysqli_insert_id($link);
 	}
 
-$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |" . implode("-", $group) . ", $query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';";
+$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';";
 if ($DB) {echo "|$stmt|\n";}
 $rslt=mysql_to_mysqli($stmt, $link);
 $report_log_id = mysqli_insert_id($link);
@@ -288,13 +307,13 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_
 	}
 
 $stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER';";
-if ($DB) {$HTML_text.="|$stmt|\n";}
+if ($DB) {echo "|$stmt|\n";}
 $rslt=mysql_to_mysqli($stmt, $link);
 $row=mysqli_fetch_row($rslt);
 $LOGuser_group =			$row[0];
 
 $stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';";
-if ($DB) {$HTML_text.="|$stmt|\n";}
+if ($DB) {echo "|$stmt|\n";}
 $rslt=mysql_to_mysqli($stmt, $link);
 $row=mysqli_fetch_row($rslt);
 $LOGallowed_campaigns =			$row[0];
@@ -344,7 +363,7 @@ if ( (!preg_match('/\-\-ALL\-\-/i', $LOGadmin_viewable_call_times)) and (strlen(
 
 $stmt="select group_id from vicidial_inbound_groups $whereLOGadmin_viewable_groupsSQL order by group_id;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {$HTML_text.="$stmt\n";}
+if ($DB) {echo "$stmt\n";}
 $groups_to_print = mysqli_num_rows($rslt);
 $i=0;
 $groups_string='|';
@@ -359,7 +378,7 @@ while ($i < $groups_to_print)
 
 $stmt="SELECT campaign_id from vicidial_campaigns $whereLOGallowed_campaignsSQL order by campaign_id;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {$HTML_text.="$stmt\n";}
+if ($DB) {echo "$stmt\n";}
 $campaigns_to_print = mysqli_num_rows($rslt);
 $i=0;
 $campaigns=array();
@@ -379,7 +398,7 @@ for ($i=0; $i<count($user_group); $i++)
 
 $stmt="SELECT user_group from vicidial_user_groups $whereLOGadmin_viewable_groupsSQL order by user_group;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {$HTML_text.="$stmt\n";}
+if ($DB) {echo "$stmt\n";}
 $user_groups_to_print = mysqli_num_rows($rslt);
 $i=0;
 #$user_groups[$i]="Auto-dial agents";
@@ -395,7 +414,7 @@ while ($i < $user_groups_to_print)
 
 $stmt="SELECT user, full_name from vicidial_users $whereLOGadmin_viewable_groupsSQL order by user";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {$HTML_text.="$stmt\n";}
+if ($DB) {echo "$stmt\n";}
 $users_to_print = mysqli_num_rows($rslt);
 $i=0;
 $user_list=array();
@@ -414,6 +433,7 @@ $campaign_string='|';
 $campaign_ct = count($campaign);
 while($i < $campaign_ct)
 	{
+	$campaign[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $campaign[$i]);
 	if ( (preg_match("/ $campaign[$i] /",$regexLOGallowed_campaigns)) or (preg_match("/-ALL/",$LOGallowed_campaigns)) )
 		{
 		$campaign_string .= "$campaign[$i]|";
@@ -443,6 +463,7 @@ $user_group_string='|';
 $user_group_ct = count($user_group);
 while($i < $user_group_ct)
 	{
+	$user_group[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $user_group[$i]);
 	$user_group_string .= "$user_group[$i]|";
 	$user_group_SQL .= "'$user_group[$i]',";
 	$user_groupQS .= "&user_group[]=$user_group[$i]";
@@ -470,6 +491,7 @@ $users_string='|';
 $user_ct = count($users);
 while($i < $user_ct)
 	{
+	$users[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $users[$i]);
 	$users_string .= "$users[$i]|";
 	$user_SQL .= "'$users[$i]',";
 	$userQS .= "&users[]=$users[$i]";
@@ -494,6 +516,18 @@ else
 	$user_SQL = "and user IN($user_SQL)";
 	}
 
+$i=0;
+$group_string='|';
+$group_ct = count($group);
+while($i < $group_ct)
+	{
+	$group[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $group[$i]);
+	$group_string .= "$group[$i]|";
+	$group_SQL .= "'$group[$i]',";
+	$groupQS .= "&group[]=$group[$i]";
+	$i++;
+	}
+
 require("screen_colors.php");
 
 # $NWB = " &nbsp; <a href=\"javascript:openNewWindow('help.php?ADD=99999";
@@ -685,7 +719,7 @@ if ($campaign_ct>0 || $user_group_ct>0 || $user_ct>0) {
 	$total_agent_stmt="select distinct user from ".$vicidial_agent_log_table." where event_time >= '$query_date_BEGIN' and event_time <= '$query_date_END' $campaign_agent_log_SQL $user_group_agent_log_SQL $user_group_agent_log_SQL order by user";
 	$total_agent_rslt=mysql_to_mysqli($total_agent_stmt, $link);
 	$total_user_SQL="";
-	if ($DB) {$HTML_text.="$total_agent_stmt\n";}
+	if ($DB) {echo "$total_agent_stmt\n";}
 	while ($agent_row=mysqli_fetch_row($total_agent_rslt)) {
 		$total_user_SQL .= "'$agent_row[0]',";
 	}
@@ -700,7 +734,7 @@ if ($campaign_ct>0 || $user_group_ct>0 || $user_ct>0) {
 	/*
 	# xfers originating from outbound calls
 	$xfer_stmt="select ".$vicidial_log_table.".call_date, ".$vicidial_log_table.".lead_id, ".$vicidial_log_table.".user, ".$vicidial_log_table.".user_group, ".$vicidial_log_table.".campaign_id, ".$vicidial_xfer_log_table.".campaign_id, ".$vicidial_agent_log_table.".campaign_id, ".$vicidial_closer_log_table.".campaign_id, ".$vicidial_closer_log_table.".user, ".$vicidial_closer_log_table.".user_group, ".$vicidial_closer_log_table.".call_date, ".$vicidial_closer_log_table.".uniqueid from ".$vicidial_log_table.", ".$vicidial_xfer_log_table.", ".$vicidial_agent_log_table.", ".$vicidial_closer_log_table." where ".$vicidial_log_table.".call_date>='$query_date_BEGIN' and ".$vicidial_log_table.".call_date<='$query_date_END' and ".$vicidial_log_table.".lead_id=".$vicidial_xfer_log_table.".lead_id and ".$vicidial_xfer_log_table.".campaign_id='" . mysqli_real_escape_string($link, $group) . "' and ".$vicidial_xfer_log_table.".call_date>='$query_date_BEGIN' and ".$vicidial_xfer_log_table.".call_date<='$query_date_END' and ".$vicidial_xfer_log_table.".xfercallid=".$vicidial_closer_log_table.".xfercallid and ".$vicidial_xfer_log_table.".lead_id=".$vicidial_closer_log_table.".lead_id and ".$vicidial_xfer_log_table.".closer=".$vicidial_closer_log_table.".user and ".$vicidial_closer_log_table.".call_date>='$query_date_BEGIN' and ".$vicidial_closer_log_table.".call_date<='$query_date_END' and ".$vicidial_closer_log_table.".uniqueid=".$vicidial_agent_log_table.".uniqueid and ".$vicidial_agent_log_table.".event_time>='$query_date_BEGIN' and ".$vicidial_agent_log_table.".event_time<='$query_date_END' and timediff(".$vicidial_xfer_log_table.".call_date, ".$vicidial_log_table.".call_date)<'00:30:00' and timediff(".$vicidial_xfer_log_table.".call_date, ".$vicidial_log_table.".call_date)>='0' $user_agent_log_SQL $user_vicidial_log_SQL $user_xfer_log_SQL $user_closer_log_SQL $user_group_agent_log_SQL $user_group_vicidial_log_SQL $user_group_closer_log_SQL $campaign_agent_log_SQL $campaign_vicidial_log_SQL";
-	if ($DB) {$HTML_text.="<B>$xfer_stmt</B>\n";}
+	if ($DB) {echo "<B>$xfer_stmt</B>\n";}
 	$xfer_rslt=mysql_to_mysqli($xfer_stmt, $link);
 	while ($xfer_row=mysqli_fetch_row($xfer_rslt)) {
 		array_push($complete_xfer_log, $xfer_row);
@@ -708,7 +742,7 @@ if ($campaign_ct>0 || $user_group_ct>0 || $user_ct>0) {
 
 	# xfers originating from inbound calls
 	$xfer_stmt1="select ".$vicidial_closer_log_table.".call_date, ".$vicidial_closer_log_table.".lead_id, ".$vicidial_closer_log_table.".user, ".$vicidial_closer_log_table.".user_group, ".$vicidial_agent_log_table.".campaign_id, ".$vicidial_closer_log_table.".campaign_id as ingroup, ".$vicidial_xfer_log_table.".xfercallid from ".$vicidial_closer_log_table.", ".$vicidial_agent_log_table.", ".$vicidial_xfer_log_table." where ".$vicidial_xfer_log_table.".campaign_id='" . mysqli_real_escape_string($link, $group) . "' and ".$vicidial_closer_log_table.".call_date>='$query_date_BEGIN' and ".$vicidial_closer_log_table.".call_date<='$query_date_END' and ".$vicidial_closer_log_table.".lead_id=".$vicidial_xfer_log_table.".lead_id and ".$vicidial_closer_log_table.".xfercallid=0 and ".$vicidial_closer_log_table.".user=".$vicidial_xfer_log_table.".user and ".$vicidial_xfer_log_table.".call_date>='$query_date_BEGIN' and ".$vicidial_xfer_log_table.".call_date<='$query_date_END' and ".$vicidial_closer_log_table.".uniqueid=".$vicidial_agent_log_table.".uniqueid and ".$vicidial_agent_log_table.".event_time>='$query_date_BEGIN' and ".$vicidial_agent_log_table.".event_time<='$query_date_END' and timediff(".$vicidial_xfer_log_table.".call_date, ".$vicidial_closer_log_table.".call_date)<'00:30:00' and timediff(".$vicidial_xfer_log_table.".call_date, ".$vicidial_closer_log_table.".call_date)>='0' $user_agent_log_SQL $user_xfer_log_SQL $user_closer_log_SQL $user_group_agent_log_SQL $user_group_closer_log_SQL $campaign_agent_log_SQL";
-	if ($DB) {$HTML_text.="<B>$xfer_stmt1</B>\n";}
+	if ($DB) {echo "<B>$xfer_stmt1</B>\n";}
 	$xfer_rslt1=mysql_to_mysqli($xfer_stmt1, $link);
 	while ($xfer_row1=mysqli_fetch_row($xfer_rslt1)) {
 		$temp_array=array();
@@ -716,7 +750,7 @@ if ($campaign_ct>0 || $user_group_ct>0 || $user_ct>0) {
 		array_push($temp_array, "$xfer_row1[0]", "$xfer_row1[1]", "$xfer_row1[2]", "$xfer_row1[3]", "$xfer_row1[4]", "$xfer_row1[5]");
 
 		$xfer_stmt2="select ".$vicidial_agent_log_table.".campaign_id, ".$vicidial_closer_log_table.".campaign_id, ".$vicidial_closer_log_table.".user, ".$vicidial_closer_log_table.".user_group, ".$vicidial_closer_log_table.".call_date from ".$vicidial_agent_log_table.", ".$vicidial_xfer_log_table.", ".$vicidial_closer_log_table." where ".$vicidial_xfer_log_table.".xfercallid='$xfercallid' and ".$vicidial_xfer_log_table.".lead_id=".$vicidial_closer_log_table.".lead_id and ".$vicidial_xfer_log_table.".closer=".$vicidial_closer_log_table.".user and ".$vicidial_closer_log_table.".uniqueid=".$vicidial_agent_log_table.".uniqueid and ".$vicidial_closer_log_table.".xfercallid='$xfercallid' and ".$vicidial_agent_log_table.".event_time>='$query_date_BEGIN' and ".$vicidial_agent_log_table.".event_time<='$query_date_END'";
-		if ($DB) {$HTML_text.="<B>$xfer_stmt2</B>\n";}
+		if ($DB) {echo "<B>$xfer_stmt2</B>\n";}
 		$xfer_rslt2=mysql_to_mysqli($xfer_stmt2, $link);
 		while ($xfer_row2=mysqli_fetch_row($xfer_rslt2)) {
 			array_push($temp_array, "$xfer_row2[0]", "$xfer_row2[1]", "$xfer_row2[2]", "$xfer_row2[3]", "$xfer_row2[4]");
@@ -728,7 +762,7 @@ if ($campaign_ct>0 || $user_group_ct>0 || $user_ct>0) {
 
 	$complete_xfer_log=array();
 	$xfer_log_stmt="select * from vicidial_xfer_log where campaign_id in ('" . implode("','", array_map(array($link, 'real_escape_string'), $group)) . "') and call_date>='$query_date_BEGIN' and call_date<='$query_date_END' $user_SQL";
-	if ($DB) {$HTML_text.="<B>$xfer_log_stmt</B>\n";}
+	if ($DB) {echo "<B>$xfer_log_stmt</B>\n";}
 	$xfer_log_rslt=mysql_to_mysqli($xfer_log_stmt, $link);
 	while ($xfer_row=mysqli_fetch_array($xfer_log_rslt)) {
 		$temp_array=array();
@@ -744,7 +778,7 @@ if ($campaign_ct>0 || $user_group_ct>0 || $user_ct>0) {
 
 		$fronter_log_stmt="select call_date, user_group, campaign_id from vicidial_log where lead_id='$xfer_row[lead_id]' and user='$xfer_row[user]' and call_date>='$xfer_row[call_date]'-INTERVAL 30 MINUTE and call_date<='$xfer_row[call_date]' $campaign_SQL $user_group_SQL order by call_date desc limit 1";
 		$fronter_log_rslt=mysql_to_mysqli($fronter_log_stmt, $link);
-		if ($DB) {$HTML_text.="<B>$fronter_log_stmt</B>\n";}
+		if ($DB) {echo "<B>$fronter_log_stmt</B>\n";}
 		if (mysqli_num_rows($fronter_log_rslt)>0) {
 			while ($fronter_row=mysqli_fetch_array($fronter_log_rslt)) {
 				$call_date=$fronter_row["call_date"];
@@ -765,7 +799,7 @@ if ($campaign_ct>0 || $user_group_ct>0 || $user_ct>0) {
 		} else {
 			$closer_log_stmt="select uniqueid, user_group, call_date from vicidial_closer_log where call_date>='$xfer_row[call_date]'-INTERVAL 30 MINUTE and call_date<='$xfer_row[call_date]' and lead_id='$xfer_row[lead_id]' and user='$xfer_row[user]' order by call_date desc limit 1";
 			$closer_log_rslt=mysql_to_mysqli($closer_log_stmt, $link);
-			if ($DB) {$HTML_text.="<B>$closer_log_stmt</B>\n";}
+			if ($DB) {echo "<B>$closer_log_stmt</B>\n";}
 			while ($closer_row=mysqli_fetch_array($closer_log_rslt)) {
 				$call_date=$closer_row["call_date"];
 				$lead_id=$xfer_row["lead_id"];
@@ -789,7 +823,7 @@ if ($campaign_ct>0 || $user_group_ct>0 || $user_ct>0) {
 
 			$closer_xfer_log_stmt="select uniqueid, campaign_id, call_date, status from vicidial_closer_log where campaign_id in ('" . implode("','", array_map(array($link, 'real_escape_string'), $group)) . "') and call_date>='$xfer_row[call_date]' and call_date<='$xfer_row[call_date]'+INTERVAL 1 HOUR and xfercallid='$xfercallid' and user='$closer' $user_SQL $user_group_SQL order by call_date asc limit 1";
 			$closer_xfer_log_rslt=mysql_to_mysqli($closer_xfer_log_stmt, $link);
-			if ($DB) {$HTML_text.="<B>$closer_xfer_log_stmt</B>\n";}
+			if ($DB) {echo "<B>$closer_xfer_log_stmt</B>\n";}
 			if (mysqli_num_rows($closer_xfer_log_rslt)>0) {
 				$closer_xfer_row=mysqli_fetch_array($closer_xfer_log_rslt);
 				$closer_uid=$closer_xfer_row["uniqueid"];
@@ -865,7 +899,7 @@ $HTML_text.="---------- "._QXZ("TOTALS FOR")." $query_date_BEGIN "._QXZ("to")."
 
 $SQL_group_id = preg_replace("/_/",'\\_',$group);
 $sale_dispo_stmt="select distinct status from vicidial_campaign_statuses where sale='Y' and campaign_id in (SELECT campaign_id from vicidial_campaigns where closer_campaigns LIKE \"% " . implode(" %\" OR closer_campaigns LIKE \"% ", array_map(array($link, 'real_escape_string'), $SQL_group_id)) . " %\" $LOGallowed_campaignsSQL) UNION select distinct status from vicidial_statuses where sale='Y'";
-if ($DB) {$HTML_text.="$sale_dispo_stmt\n";}
+if ($DB) {echo "$sale_dispo_stmt\n";}
 $sale_dispo_rslt=mysql_to_mysqli($sale_dispo_stmt, $link);
 $sale_dispos="'SALE'"; $sale_dispo_str="|SALE";
 while ($ssrow=mysqli_fetch_row($sale_dispo_rslt)) {
@@ -877,7 +911,7 @@ if ($DB) {$HTML_text.=_QXZ("Sale dispo string").": $sale_dispo_str\n";}
 
 $stmt="select count(*) from ".$vicidial_closer_log_table." where call_date >= '$query_date_BEGIN' and call_date <= '$query_date_END' and campaign_id in ('" . implode("','", array_map(array($link, 'real_escape_string'), $group)) . "') and status in ($sale_dispos);";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {$HTML_text.="$stmt\n";}
+if ($DB) {echo "$stmt\n";}
 $row=mysqli_fetch_row($rslt);
 
 $HTML_text.=_QXZ("STATUS",8)." "._QXZ("CUSTOMERS")."\n";
@@ -1411,6 +1445,7 @@ $CSV_closer_footer.="\""._QXZ("TOTAL CLOSERS").":  $TOTagents\",\"$TOTcalls\",\"
 	$HTML_head.=$HTML_graph_head;
 	$GRAPH_text.=$graphCanvas;
 }
+}
 
 $ENDtime = date("U");
 $RUNtime = ($ENDtime - $STARTtime);
@@ -1423,7 +1458,7 @@ else
 	$HTML_text.=$ASCII_text;
 	}
 
-if ($DB) {$HTML_text.="\n"._QXZ("Run Time").": $RUNtime "._QXZ("seconds")."|$db_source\n";}
+if ($DB) {echo "\n"._QXZ("Run Time").": $RUNtime "._QXZ("seconds")."|$db_source\n";}
 
 $HTML_text.="</PRE>\n";
 
@@ -1482,7 +1517,6 @@ $rslt=mysql_to_mysqli($stmt, $link);
 
 exit;
 
-}
 
 
 ?>
diff --git a/www/vicidial/lead_report_export.php b/www/vicidial/lead_report_export.php
index 7c4c5be4..bb418c3b 100644
--- a/www/vicidial/lead_report_export.php
+++ b/www/vicidial/lead_report_export.php
@@ -5,7 +5,7 @@
 # vicidial_log and/or vicidial_closer_log information by status, list_id and 
 # date range. downloads to a flat text file that is tab delimited
 #
-# Copyright (C) 2021  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # CHANGES
 #
@@ -36,6 +36,7 @@
 # 190926-0926 - Fixes for PHP7
 # 210302-0839 - Added exclude_call_log_data option
 # 210911-1906 - Fix for --ALL-- selection user-group permission issue
+# 220228-1917 - Added allow_web_debug system setting
 #
 
 $startMS = microtime();
@@ -100,19 +101,30 @@ if (isset($_GET["VLC_enabled"]))			{$VLC_enabled=$_GET["VLC_enabled"];}
 if (isset($_GET["exclude_call_log_data"]))			{$exclude_call_log_data=$_GET["exclude_call_log_data"];}
 	elseif (isset($_POST["exclude_call_log_data"]))	{$exclude_call_log_data=$_POST["exclude_call_log_data"];}
 
-
-if (strlen($shift)<2) {$shift='ALL';}
 $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
+$US='_';
+$MT[0]='';
+$ip = getenv("REMOTE_ADDR");
+$NOW_DATE = date("Y-m-d");
+$NOW_TIME = date("Y-m-d H:i:s");
+$FILE_TIME = date("Ymd-His");
+$STARTtime = date("U");
+if (!isset($group)) {$group = array();}
+if (!isset($dids)) {$dids = array();}
+if (!isset($query_date)) {$query_date = $NOW_DATE;}
+if (!isset($end_date)) {$end_date = $NOW_DATE;}
+if (strlen($shift)<2) {$shift='ALL';}
+
 $report_name = 'Export Leads Report';
 $db_source = 'M';
 $file_exported=0;
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,custom_fields_enabled,enable_languages,language_method,active_modules FROM system_settings;";
+$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,custom_fields_enabled,enable_languages,language_method,active_modules,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -125,10 +137,50 @@ if ($qm_conf_ct > 0)
 	$SSenable_languages =			$row[5];
 	$SSlanguage_method =			$row[6];
 	$active_modules =				$row[7];
+	$SSallow_web_debug =			$row[8];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
 
+$query_date = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $query_date);
+$end_date = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $end_date);
+$date_field = preg_replace('/[^-\.\_0-9a-zA-Z]/', '', $date_field);
+$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT);
+$did_filter = preg_replace('/[^-_0-9a-zA-Z]/', '', $did_filter);
+$vlc_filter = preg_replace('/[^-_0-9a-zA-Z]/', '', $vlc_filter);
+$run_export = preg_replace('/[^-_0-9a-zA-Z]/', '', $run_export);
+$header_row = preg_replace('/[^-_0-9a-zA-Z]/', '', $header_row);
+$rec_fields = preg_replace('/[^-_0-9a-zA-Z]/', '', $rec_fields);
+$custom_fields = preg_replace('/[^-_0-9a-zA-Z]/', '', $custom_fields);
+$call_notes = preg_replace('/[^-_0-9a-zA-Z]/', '', $call_notes);
+$export_fields = preg_replace('/[^-_0-9a-zA-Z]/', '', $export_fields);
+$search_archived_data = preg_replace('/[^-_0-9a-zA-Z]/', '', $search_archived_data);
+$vicidial_list_archive_only = preg_replace('/[^-_0-9a-zA-Z]/', '', $vicidial_list_archive_only);
+$VLC_enabled = preg_replace('/[^-_0-9a-zA-Z]/', '', $VLC_enabled);
+$exclude_call_log_data = preg_replace('/[^-_0-9a-zA-Z]/', '', $exclude_call_log_data);
+
+# Variables filtered further down in the code
+# $campaign
+# $group
+# $user_group
+# $list_id
+# $status
+# $dids
+# $vlcs
+
+if ($non_latin < 1)
+	{
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
+	}
+else
+	{
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
+	}
+
 ### ARCHIVED DATA CHECK CONFIGURATION
 $archives_available="N";
 $log_tables_array=array("vicidial_did_log", "vicidial_log", "vicidial_closer_log", "vicidial_log_extended", "recording_log", "vicidial_carrier_log", "vicidial_cpd_log", "vicidial_list");
@@ -170,17 +222,6 @@ else
 	}
 #############
 
-if ($non_latin < 1)
-	{
-	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
-	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
-	}
-else
-	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
-	}
-
 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
 if ($DB) {echo "|$stmt|\n";}
 $rslt=mysql_to_mysqli($stmt, $link);
@@ -304,7 +345,7 @@ else
 	$webserver_id = mysqli_insert_id($link);
 	}
 
-$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$campaign[0], $query_date, $end_date|', url='$LOGfull_url', webserver='$webserver_id';";
+$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date|', url='$LOGfull_url', webserver='$webserver_id';";
 if ($DB) {echo "|$stmt|\n";}
 $rslt=mysql_to_mysqli($stmt, $link);
 $report_log_id = mysqli_insert_id($link);
@@ -370,17 +411,6 @@ if ( (!preg_match('/\-\-ALL\-\-/i', $LOGadmin_viewable_call_times)) and (strlen(
 ##### START RUN THE EXPORT AND OUTPUT FLAT DATA FILE #####
 if ($run_export > 0)
 	{
-	$US='_';
-	$MT[0]='';
-	$ip = getenv("REMOTE_ADDR");
-	$NOW_DATE = date("Y-m-d");
-	$NOW_TIME = date("Y-m-d H:i:s");
-	$FILE_TIME = date("Ymd-His");
-	$STARTtime = date("U");
-	if (!isset($group)) {$group = array();}
-	if (!isset($dids)) {$dids = array();}
-	if (!isset($query_date)) {$query_date = $NOW_DATE;}
-	if (!isset($end_date)) {$end_date = $NOW_DATE;}
 	if ($date_field=="entry_date") {
 		$date_field = "vi.entry_date";
 		$export_fields = "EXTENDED"; # Since entry_date only appears when the EXTENDED export option is selected, EXTENDED will automatically be used when entry_date is selected as the date field.
@@ -420,6 +450,7 @@ if ($run_export > 0)
 	$i=0;
 	while($i < $campaign_ct)
 		{
+		$campaign[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $campaign[$i]);
 		if ( (preg_match("/ $campaign[$i] /",$regexLOGallowed_campaigns)) or (preg_match("/-ALL/",$LOGallowed_campaigns)) )
 			{
 			$campaign_string .= "$campaign[$i]|";
@@ -468,6 +499,7 @@ if ($run_export > 0)
 	$i=0;
 	while($i < $group_ct)
 		{
+		$group[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $group[$i]);
 		$group_string .= "$group[$i]|";
 		$group_SQL .= "'$group[$i]',";
 		$i++;
@@ -497,6 +529,7 @@ if ($run_export > 0)
 	$i=0;
 	while($i < $did_ct)
 		{
+		$dids[$i] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $dids[$i]);
 		$did_string .= "$dids[$i]|";
 		$did_SQL .= "'$dids[$i]',";
 		$i++;
@@ -518,6 +551,7 @@ if ($run_export > 0)
 	$i=0;
 	while($i < $vlc_ct)
 		{
+		$vlcs[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $vlcs[$i]);
 		$vlc_string .= "$vlcs[$i]|";
 		$vlc_SQL .= "'$vlcs[$i]',";
 		$i++;
@@ -553,6 +587,7 @@ if ($run_export > 0)
 	$i=0;
 	while($i < $user_group_ct)
 		{
+		$user_group[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $user_group[$i]);
 		$user_group_string .= "$user_group[$i]|";
 		$user_group_SQL .= "'$user_group[$i]',";
 		$i++;
@@ -587,6 +622,7 @@ if ($run_export > 0)
 	$i=0;
 	while($i < $list_ct)
 		{
+		$list_id[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $list_id[$i]);
 		$list_string .= "$list_id[$i]|";
 		$list_SQL .= "'$list_id[$i]',";
 		$i++;
@@ -633,6 +669,7 @@ if ($run_export > 0)
 	$i=0;
 	while($i < $status_ct)
 		{
+		$status[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $status[$i]);
 		$status_string .= "$status[$i]|";
 		$status_SQL .= "'$status[$i]',";
 		$i++;
@@ -1341,13 +1378,6 @@ if ($run_export > 0)
 
 else
 	{
-	$NOW_DATE = date("Y-m-d");
-	$NOW_TIME = date("Y-m-d H:i:s");
-	$STARTtime = date("U");
-	if (!isset($group)) {$group = array();}
-	if (!isset($dids)) {$dids = array();}
-	if (!isset($query_date)) {$query_date = $NOW_DATE;}
-	if (!isset($end_date)) {$end_date = $NOW_DATE;}
 	if ($date_field=="entry_date") {
 		$date_field = "vi.entry_date";
 		$export_fields = "EXTENDED"; # Since entry_date only appears when the EXTENDED export option is selected, EXTENDED will automatically be used when entry_date is selected as the date field.
diff --git a/www/vicidial/medialog_inventory_report.php b/www/vicidial/medialog_inventory_report.php
index b401a1d2..ea81010d 100644
--- a/www/vicidial/medialog_inventory_report.php
+++ b/www/vicidial/medialog_inventory_report.php
@@ -1,7 +1,7 @@
 <?php
 # medialog_inventory_report.php
 # 
-# Copyright (C) 2018  Joe Johnson <freewermadmin@gmail.com>, Matt Florell <mattf@vicidial.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Joe Johnson <freewermadmin@gmail.com>, Matt Florell <mattf@vicidial.com>    LICENSE: AGPLv2
 #
 # This is a report designed for showing custom statistics based on client
 # requirements. This is not a standard VICIdial report.
@@ -12,6 +12,7 @@
 # 160427-1655 - Added called count categories
 # 170409-1540 - Added IP List validation code
 # 180508-2315 - Added new help display
+# 220228-1715 - Added allow_web_debug system setting
 #
 
 $startMS = microtime();
@@ -29,25 +30,21 @@ $PHP_SELF=$_SERVER['PHP_SELF'];
 $PHP_SELF = preg_replace('/\.php.*/i','.php',$PHP_SELF);
 if (isset($_GET["list_ids"]))				{$list_ids=$_GET["list_ids"];}
 	elseif (isset($_POST["list_ids"]))		{$list_ids=$_POST["list_ids"];}
-if (isset($_GET["override_date"]))				{$override_date=$_GET["override_date"];}
-	elseif (isset($_POST["override_date"]))	{$override_date=$_POST["override_date"];}
 if (isset($_GET["group"]))				{$group=$_GET["group"];}
-	elseif (isset($_POST["group"]))	{$group=$_POST["group"];}
+	elseif (isset($_POST["group"]))		{$group=$_POST["group"];}
 if (isset($_GET["query_date"]))				{$query_date=$_GET["query_date"];}
 	elseif (isset($_POST["query_date"]))	{$query_date=$_POST["query_date"];}
 if (isset($_GET["end_date"]))				{$end_date=$_GET["end_date"];}
 	elseif (isset($_POST["end_date"]))		{$end_date=$_POST["end_date"];}
-if (isset($_GET["shift"]))				{$shift=$_GET["shift"];}
-	elseif (isset($_POST["shift"]))		{$shift=$_POST["shift"];}
 if (isset($_GET["DB"]))					{$DB=$_GET["DB"];}
 	elseif (isset($_POST["DB"]))		{$DB=$_POST["DB"];}
 if (isset($_GET["submit"]))				{$submit=$_GET["submit"];}
 	elseif (isset($_POST["submit"]))	{$submit=$_POST["submit"];}
-if (isset($_GET["file_download"]))				{$file_download=$_GET["file_download"];}
+if (isset($_GET["file_download"]))			{$file_download=$_GET["file_download"];}
 	elseif (isset($_POST["file_download"]))	{$file_download=$_POST["file_download"];}
 if (isset($_GET["SUBMIT"]))				{$SUBMIT=$_GET["SUBMIT"];}
 	elseif (isset($_POST["SUBMIT"]))	{$SUBMIT=$_POST["SUBMIT"];}
-if (isset($_GET["report_display_type"]))				{$report_display_type=$_GET["report_display_type"];}
+if (isset($_GET["report_display_type"]))			{$report_display_type=$_GET["report_display_type"];}
 	elseif (isset($_POST["report_display_type"]))	{$report_display_type=$_POST["report_display_type"];}
 if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search_archived_data"];}
 	elseif (isset($_POST["search_archived_data"]))	{$search_archived_data=$_POST["search_archived_data"];}
@@ -70,7 +67,7 @@ $JS_text.="  }\n";
 $JS_onload="onload = function() {\n";
 
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method FROM system_settings;";
+$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
 # if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
@@ -83,10 +80,35 @@ if ($qm_conf_ct > 0)
 	$reports_use_slave_db =			$row[3];
 	$SSenable_languages =			$row[4];
 	$SSlanguage_method =			$row[5];
+	$SSallow_web_debug =			$row[6];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
 
+$query_date = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $query_date);
+$end_date = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $end_date);
+$file_download = preg_replace('/[^-_0-9a-zA-Z]/', '', $file_download);
+$report_display_type = preg_replace('/[^-_0-9a-zA-Z]/', '', $report_display_type);
+$search_archived_data = preg_replace('/[^-_0-9a-zA-Z]/', '', $search_archived_data);
+$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT);
+
+# Variables filtered further down in the code
+# $group
+# $list_ids
+
+if ($non_latin < 1)
+	{
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
+	}
+else
+	{
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
+	}
+
 ### ARCHIVED DATA CHECK CONFIGURATION
 $archives_available="N";
 $log_tables_array=array("vicidial_list", "vicidial_log", "vicidial_closer_log", "vicidial_agent_log", "user_call_log");
@@ -126,18 +148,6 @@ if ($srv_conf_ct > 0)
 	$carrier_logging_active =		$row[0];
 	}
 
-if ($non_latin < 1)
-	{
-	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
-	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
-	}
-else
-	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
-	}
-$group = preg_replace("/'|\"|\\\\|;/","",$group);
-
 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
 # if ($DB) {echo "|$stmt|\n";}
 $rslt=mysql_to_mysqli($stmt, $link);
@@ -245,7 +255,7 @@ else
 	$webserver_id = mysqli_insert_id($link);
 	}
 
-$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$group[0], $query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';";
+$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';";
 # if ($DB) {echo "|$stmt|\n";}
 $rslt=mysql_to_mysqli($stmt, $link);
 $report_log_id = mysqli_insert_id($link);
@@ -365,6 +375,7 @@ $group_ct = count($group);
 $group_SQL='';
 while($i < $group_ct)
 	{
+	$group[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $group[$i]);
 	if ( (preg_match("/ $group[$i] /",$regexLOGallowed_campaigns)) or (preg_match("/-ALL/",$LOGallowed_campaigns)) )
 		{
 		$group_string .= "$group[$i]|";
@@ -415,6 +426,7 @@ $list_id_string='|';
 $list_id_ct = count($list_ids);
 while($i < $list_id_ct)
 	{
+	$list_ids[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $list_ids[$i]);
 	$list_id_string .= "$list_ids[$i]|";
 	$list_id_SQL .= "'$list_ids[$i]',";
 	$list_idQS .= "&list_ids[]=$list_ids[$i]";